DPDPEnforced May 13, 2027Checklist →
Book demo
DPDP ACT 2023 · STATUTORY COMPLIANCE PLATFORM

The Complete DPDP Consent Compliance Platform for Indian Enterprises

Deliver itemised Section 6 notices in all 22 Scheduled Indian languages, seal affirmative consents with cryptographic HMAC-SHA256 receipts, and automate Data Principal Rights with zero cross-border data transit.

Schedule Architecture DemoView Indian Rupee Pricing
§ 6(10)
Reversal of Proof
22 Langs
8th Schedule
100% Mumbai
Data Sovereign
< 12 KB
Zero-Lag Widget
< 12 KB
Widget Payload

Zero main-thread render blocking

22
Constitutional Languages

All 8th Schedule Indian languages

100% India
Data Residency

AWS Mumbai (ap-south-1) sovereign vault

HMAC-SHA256
Audit Proof

Merkle tree tamper-evident receipts

STATUTORY ARCHITECTURE

Direct Alignment with the Digital Personal Data Protection Act 2023

Unlike global cookie banners adapted after the fact, ConsentPlix is engineered specifically to satisfy statutory obligations codified under DPDP Act Sections 5 through 14.

Section 5 & 6

Itemised Notice & Unbundled Consent

Present clear, standalone notices in plain language specifying exact data items, processing purposes, and Data Fiduciary identity before collecting personal data.

  • Zero pre-ticked checkboxes or forced bundled consents
  • Individual toggles per processing purpose (analytics, marketing, sharing)
  • Real-time language toggle across all 22 official languages
  • Itemised notice with dedicated grievance officer contact
Section 6(4)

Unconditional Consent Withdrawal

Withdrawal of consent must be as effortless and immediate as giving it. One-click revocation automatically halts downstream processing across all systems.

  • Synchronous webhook dispatch to CRM, CDP, and databases
  • Automated tag deactivation via Google Consent Mode v2
  • Signed revocation certificates with statutory timestamps
  • Persistent preference center accessible on every page
Section 8 & 12

Data Principal Rights & Erasure Vault

Empower users with verifiable self-serve portals for data access, correction, nomination, and erasure, balanced with statutory retention overrides.

  • Automated intake for access, correction, and erasure requests
  • Smart conflict-of-law holds for RBI, PMLA, and tax retention
  • Statutory nominee registration workflow (§14)
  • Deterministic identity verification without extra PII storage
Section 13

Grievance Redressal Officer (GRO) Desk

Built-in ticketing desk strictly tracking statutory DPDP response windows before complaints can be escalated to the Data Protection Board of India.

  • Mandatory GRO details dynamically rendered in all 22 languages
  • SLA countdown clocks with 72-hour and statutory deadline alerts
  • Audit log of every correspondence and resolution milestone
  • Exportable case dossiers formatted for DPBI inquiries
CONSENT LIFECYCLE & CHAIN OF CUSTODY

From banner click to audit-ready, tamper-evident proof

ConsentPlix intercepts tracking scripts before execution, captures unambiguous visitor decisions through itemized statutory notices, computes an HMAC-SHA256 signature across 11 canonical fields, and anchors the record into daily Merkle checkpoint roots. Every event yields a tamper-evident, independently verifiable audit receipt.

Explore Ledger Engine →
Script InterceptionPRE-TAG INGRESS

Zero-Delay Script Interception

0ms Main Thread Delay · Pre-GTM Execution

Sub-12KB autonomous SDK loads deterministically before Google Tag Manager and third-party ad pixels fire. Holds non-essential trackers in queue until affirmative consent is given.

GTM SCRIPTHELDAUTHORIZED
<script src="cp.min.js" data-site-token="..."></script>< 12 KB IIFE
Statutory Notice22 CONSTITUTIONAL LANGUAGES

Verifiable Statutory Notice

Zero Pre-Ticked Toggles · One-Click Revoke

Renders clear, itemized notice in English and all 22 Eighth Schedule Indian languages. Discloses the Grievance Redressal Officer with instant Section 6(4) withdrawal.

22 LANG
NO DARK PATTERNSCOMPLIANT
Cryptographic SignatureRFC 2104 · SHA-256

HMAC-SHA256 Signed Artifact

11 Canonical Fields · KMS Key Custody

Every consent grant, refusal, or revocation is canonicalized across 11 fields and signed in hardware HSMs. Produces an unforgeable receipt code for legal audit.

HASH9f83…d71b
BURDEN OF PROOF COMPLIANTHMAC VERIFIED
Merkle Root SealRFC 6962 · DAILY ANCHORING

Merkle Checkpoint Proof Vault

Immutable Append-Only · Zero Retroactive Rewrite

Daily cryptographic Merkle tree roots seal the consent vault. Any auditor or judge can mathematically verify that a specific receipt existed on a given date without leaking customer identity.

MERKLE ROOTBRANCHBRANCH
LATEST ROOT: 9a410c2d...8b31 · AWS AP-SOUTH-1SEALED
COMPETITIVE ADVANTAGE

Why Indian Enterprises Switch from Legacy CMPs to ConsentPlix

Global CMPs were built for EU ePrivacy directives and GDPR cookie banners. The DPDP Act 2023 mandates statutory notice presentation, proof burdens, and Indian sovereign custody.

Mandate / ArchitectureConsentPlix (DPDP Native)Legacy Global CMPs
DPDP Section 6 Itemised Notice
Built-in itemised notices with purpose isolation
Cookie-only banner or bundled generic terms
22 Eighth Schedule Indian Languages
Native pre-translated strings for all 22 languages
English only or generic machine translations
Cryptographic Consent Ledger
HMAC-SHA256 receipts with Merkle tree proofs (§6(10))
Mutable plain MySQL/Postgres access logs
India Sovereign Data Residency
100% AWS Mumbai (ap-south-1) with KMS custody
EU or US cloud regions subject to cross-border transfer
Grievance Redressal Desk (§13)
Integrated GRO ticketing with statutory SLA tracking
Requires third-party helpdesk or email inbox
Widget Footprint & Speed
Sub-12KB gzipped IIFE with zero dependencies
80KB–300KB multi-bundle script with render lag
Pricing Model
Transparent from ₹399/mo with Free Hobby plan
Enterprise-only annual contracts ($3,000–$15,000+)
DPDP CONSENT CLOUD · PREDICTABLE PRICING

Predictable pricing for audit-ready consent proof.

Every plan includes the sub-12KB autonomous SDK, cryptographically signed consent receipts, immutable audit trails, and sovereign hosting in AWS Mumbai (ap-south-1).

Non-Disruption Guarantee (DPDP Act §6 & §8(6)): Consent banner presentation and HMAC cryptographic verification never stop, even if quotas are exceeded.
FREE FOREVER · ZERO COST
Evaluation & Hobby

Free Forever

Evaluate DPDP compliance with zero commitment on single websites and personal apps.

₹0
Free forever · No credit card required
1,000 Consents · 1 Domain
Included Capabilities
  • 1 production domain
  • 1,000 consent events per month
  • Standard DPDP compliant notice banner
  • English & Hindi notice translations
  • HMAC-SHA256 signed audit trail
  • 30-day immutable consent ledger
  • Public receipt verification (/receipt)
  • Hosted sovereign in AWS Mumbai
Get Started Free
POPULAR · D2C
D2C & Single Brand

Starter

For D2C brands, developers, and single-store sites building custom consent user interfaces.

₹399/ month + GST
25% discount available on annual billing
10,000 Consents · 1 Domain
Included Capabilities
  • 1 production domain
  • 10,000 consent events per month
  • Headless Pro Consent Studio (Custom UI & REST API)
  • All 22 scheduled Indian languages
  • 180-day cryptographic audit ledger
  • Advanced banner theme customizer
  • Data Principal rights portal (/rights)
  • Offline intake & QR code generator
Start Starter Trial
Multi-Brand & Scale

Growth

For scaling platforms, multi-brand e-commerce and companies requiring automated audit defense.

₹999/ month + GST
25% discount available on annual billing
50,000 Consents · 5 Domains
Included Capabilities
  • Up to 5 production domains
  • 50,000 consent events per month
  • Full Headless Pro Consent Studio
  • Scheduled automated cookie & script scanner
  • GTM Container JSON one-click export
  • Signed DPBI legal audit dossier export (ZIP)
  • Incident & breach notification ledger
  • 365-day cryptographic retention
Upgrade to Growth
SDF COMPLIANCE READY
Significant Data Fiduciaries

Enterprise

For high-volume brands, BFSI, and Significant Data Fiduciaries requiring dedicated VPC custody and SLA.

Custom
Tailored volume pricing · Dedicated tenancy
1,000,000+ Consents · Unlimited
Included Capabilities
  • Unlimited domains & subdomains
  • 1,000,000+ monthly consent events
  • Statutory GRO portal (DPDP §8(6))
  • Native real-time webhooks & lake streaming
  • Cross-domain consent synchronization
  • 3-Year statutory retention ledger
  • Guaranteed Mumbai residency (Dedicated VPC)
  • Dedicated compliance manager & 99.99% SLA
Book Enterprise Demo
GST @ 18% with full B2B Input Tax Credit invoices under SAC 998313 (India).Compare full feature matrix & surge packs
EDITORIAL & PRIVACY ENGINEERING

Latest Insights & Technical Architecture

Authoritative briefings on DPDP Act enforcement, cryptographic ledger design, and autonomous SDK performance from our engineering team.

View All Publications
+
Consent Manager vs Consent Management Platform: What the DPDP Act Actually Requires
STATUTORY COMPLIANCE

Consent Manager vs Consent Management Platform: What the DPDP Act Actually Requires

A DPDP Consent Manager is a registered intermediary. A CMP is software you run yourself. Here is the difference, who needs which, and the 2026–27 deadlines.

STATUTORY COMPLIANCE
Verifiable DPDP Architecture
Read Article
+
DPDP Act 2023 Consent Notice Architecture: Verifiable Itemisation Under Section 6
STATUTORY COMPLIANCE

DPDP Act 2023 Consent Notice Architecture: Verifiable Itemisation Under Section 6

How to build itemised, multilingual, withdrawable consent notices that meet DPDP Act 2023 rules and hold up in a Data Protection Board audit.

STATUTORY COMPLIANCE
Verifiable DPDP Architecture
Read Article
+
Cryptographic Consent Ledgers: Merkle Roots and Tamper-Proof Audit Trails
CRYPTOGRAPHIC LEDGER

Cryptographic Consent Ledgers: Merkle Roots and Tamper-Proof Audit Trails

Why traditional SQL database logs fail regulatory non-repudiation standards, and how append-only Merkle trees provide mathematical integrity for compliance.

CRYPTOGRAPHIC LEDGER
Verifiable DPDP Architecture
Read Article
REGULATORY COMPLIANCE INTELLIGENCE

DPDP Act Compliance FAQs

Essential insights into the statutory mandates of the Digital Personal Data Protection Act 2023 and technical deployment considerations.

What is a DPDP consent compliance platform?

A DPDP consent compliance platform is specialized software that enables Data Fiduciaries in India to fulfill statutory requirements under the Digital Personal Data Protection Act 2023. This includes presenting itemised notices in 22 Eighth Schedule languages (§5), collecting unambiguous affirmative consent (§6), maintaining cryptographic tamper-evident consent ledgers (§6(10)), offering instant consent withdrawal (§6(4)), managing Data Principal rights requests (§8 & §12), and operating a Grievance Redressal desk (§13).

How does ConsentPlix satisfy Section 6(10) of the DPDP Act 2023 regarding reversal of proof?

Under Section 6(10) of the DPDP Act, in any proceeding, the burden of proving that valid consent was given by the Data Principal lies entirely on the Data Fiduciary. Traditional cookie plugins store mutable database logs which can be challenged in court or before the Data Protection Board of India. ConsentPlix generates an 11-field canonical JSON receipt for every consent action, signs it using HMAC-SHA256 with KMS custody, and batches receipts into cryptographically verifiable Merkle trees, delivering mathematical proof of compliance.

Why are standard EU cookie banners insufficient for DPDP compliance?

EU cookie banners are designed around ePrivacy directives and GDPR cookies. The DPDP Act 2023 governs all personal data processing, not just browser cookies. Furthermore, DPDP mandates: (1) standalone notice independent of standard terms and conditions, (2) availability in English and all 22 official languages of India, (3) clear identification and contact details of the Grievance Redressal Officer, and (4) an explicit withdrawal mechanism as simple as giving consent. Global cookie banners lack native multi-lingual legal notices, GRO workflows, and Indian sovereign cloud data residency.

Where is customer consent data stored, and does it leave India?

All ConsentPlix infrastructure, consent ledgers, encryption keys, and audit proof logs are hosted exclusively within the AWS Asia Pacific (Mumbai) region (ap-south-1). No visitor telemetry, IP logs, or consent artifacts leave sovereign Indian borders, meeting RBI data localization and DPDP compliance standards.

What are the penalties under the DPDP Act for non-compliant consent mechanisms?

Under the DPDP Act 2023 Schedule, failure to fulfill obligations regarding personal data processing or consent management can attract financial penalties of up to ₹250 Crore per violation imposed by the Data Protection Board of India (DPBI). Additionally, failure to protect children’s data or notify personal data breaches attracts penalties up to ₹200 Crore.

How fast is the ConsentPlix client SDK, and does it impact Core Web Vitals?

ConsentPlix delivers an ultra-lightweight client script that weighs under 12KB gzipped with zero external dependencies. It loads asynchronously without blocking HTML parsing or impacting Largest Contentful Paint (LCP) and Interaction to Next Paint (INP). It also natively supports Google Consent Mode v2 out of the box.

ENTERPRISE DPDP READY

Ready to deploy India's fastest DPDP consent compliance platform?

Deploy our sub-12KB tag in under 10 minutes or talk to our privacy engineering specialists for custom enterprise VPC setups.

Schedule Architecture DemoExplore Documentation